Executive brief
irisnet-crypto is a JavaScript cryptography library for the IRISnet blockchain. The library contains a critical code execution flaw in its utility module that allows attackers to run arbitrary code through unsafe eval() usage. Any application using affected versions of this library could be compromised to execute attacker-controlled code, leading to data theft, system compromise, or malware installation.
Technical details
The vulnerability exists in the util/utils.js file where eval() is used unsafely to execute JavaScript code (CWE-94: Improper Control of Generation of Code). The root cause is the use of eval() on untrusted input without proper sanitization or sandboxing. The attack vector is network-based with no authentication required and no user interaction needed; any code path invoking the vulnerable eval() function with attacker-controlled data can trigger exploitation. An attacker can achieve arbitrary code execution with full application privileges. The vulnerability was fixed in version 1.1.7, which removes the unsafe eval() usage. The fix was released and is available in the repository.
Affected products
- irisnet irisnet-crypto before 1.1.7
Timeline
- 2019-01-16: disclosed: Security issue reported on GitHub
- 2019: patched: Fixed in version 1.1.7
- 2019-02-25: advisory: CVE-2019-9115 published on NVD
- 2022-05-13: advisory: GitHub Security Advisory GHSA-5fh8-x9xc-hxmc published